In the Linux kernel, the following vulnerability has been resolved:
perf trace: Really free the evsel->priv area
In 3cb4d5e00e037c70 ("perf trace: Free syscall tp fields in evsel->priv") it only was freeing if strcmp(evsel->tp_format->system, "syscalls") returned zero, while the corresponding initialization of evsel->priv was being performed if it was _not_ zero, i.e. if the tp system wasn't 'syscalls'.
Just stop looking for that and free it if evsel->priv was set, which should be equivalent.
Also use the pre-existing evsel_trace__delete() function.
This resolves these leaks, detected with:
$ make EXTRA_CFLAGS="-fsanitize=address" BUILD_BPF_SKEL=1 CORESIGHT=1 O=/tmp/build/perf-tools-next -C tools/perf install-bin
================================================================= ==481565==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f7343cba097 in calloc (/lib64/libasan.so.8+0xba097) #1 0x987966 in zalloc (/home/acme/bin/perf+0x987966) #2 0x52f9b9 in evsel_trace__new /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:307 #3 0x52f9b9 in evsel__syscall_tp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:333 #4 0x52f9b9 in evsel__init_raw_syscall_tp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:458 #5 0x52f9b9 in perf_evsel__raw_syscall_newtp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:480 #6 0x540e8b in trace__add_syscall_newtp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:3212 #7 0x540e8b in trace__run /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:3891 #8 0x540e8b in cmd_trace /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:5156 #9 0x5ef262 in run_builtin /home/acme/git/perf-tools-next/tools/perf/perf.c:323 #10 0x4196da in handle_internal_command /home/acme/git/perf-tools-next/tools/perf/perf.c:377 #11 0x4196da in run_argv /home/acme/git/perf-tools-next/tools/perf/perf.c:421 #12 0x4196da in main /home/acme/git/perf-tools-next/tools/perf/perf.c:537 #13 0x7f7342c4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)
Direct leak of 40 byte(s) in 1 object(s) allocated from: #0 0x7f7343cba097 in calloc (/lib64/libasan.so.8+0xba097) #1 0x987966 in zalloc (/home/acme/bin/perf+0x987966) #2 0x52f9b9 in evsel_trace__new /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:307 #3 0x52f9b9 in evsel__syscall_tp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:333 #4 0x52f9b9 in evsel__init_raw_syscall_tp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:458 #5 0x52f9b9 in perf_evsel__raw_syscall_newtp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:480 #6 0x540dd1 in trace__add_syscall_newtp /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:3205 #7 0x540dd1 in trace__run /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:3891 #8 0x540dd1 in cmd_trace /home/acme/git/perf-tools-next/tools/perf/builtin-trace.c:5156 #9 0x5ef262 in run_builtin /home/acme/git/perf-tools-next/tools/perf/perf.c:323 #10 0x4196da in handle_internal_command /home/acme/git/perf-tools-next/tools/perf/perf.c:377 #11 0x4196da in run_argv /home/acme/git/perf-tools-next/tools/perf/perf.c:421 #12 0x4196da in main /home/acme/git/perf-tools-next/tools/perf/perf.c:537 #13 0x7f7342c4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)
SUMMARY: AddressSanitizer: 80 byte(s) leaked in 2 allocation(s). [root@quaco ~]#
With this we plug all leaks with "perf trace sleep 1".
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-livepatch-5.15.133-86.144 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.55-75.123Upgrade perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-libbpf-develUpgrade perf-debuginfoUpgrade kernel-tools-devel | Oct 24, 2025 | Oct 7, 2025 |
| Debian | — | Upgrade linux | Oct 9, 2025 | Oct 9, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 14, 2025 | Oct 7, 2025 |
| Ubuntu | — | Upgrade linux-xilinx-zynqmpUpgrade linux-aws-5.15Upgrade linux-gkeopUpgrade linuxUpgrade linux-aws-fipsUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-azureUpgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-ibmUpgrade linux-azure-fdeUpgrade linux-gkeUpgrade linux-nvidia-tegraUpgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-oracleUpgrade linux-ibm-5.15Upgrade linux-fipsUpgrade linux-intel-iotgUpgrade linux-raspiUpgrade linux-lowlatencyUpgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-intel-iotg-5.15Upgrade linux-bluefieldUpgrade linux-realtimeUpgrade linux-nvidia-tegra-igxUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iot-realtime | Oct 10, 2025 | Oct 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub